Peter Nowak v Data Protection Commissioner

the written answers to a test, as well as the examiner’s comments on those answers, are personal data of the person who takes the test. However, the questions of the test are not personal data (this may result in a situation where a person receives a copy of an exam script with the questions of the test blacked out). At the same time, the examiner’s comments are also the personal data of the examiner. Interestingly, the Court already referred to the GDPR in its analysis, even if the Regulation is not yet applicable.

The court emphasized, in accordance with the opinion of the Advocate General, that “if the identification of the data subject was prohibited by law or practically impossible on account of the fact that it requires a disproportionate effort in terms of time, cost and man-power, so that the risk of identification appears in reality to be insignificant” then the dynamic IP addresses would not constitute ‘personal data.’

The use of the expression ‘any information’ in the definition of the concept of ‘personal data’, within Article 2(a) of Directive 95/46, reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject.

As regards the latter condition, it is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.

As is argued, in essence, by Mr Nowak, the Czech, Greek, Hungarian, Austrian and Portuguese governments and also by the European Commission, the written answers submitted by a candidate at a professional examination constitute information that is linked to him or her as a person.